Hiring fraud rarely announces itself. There's no single moment where a fake applicant gives themselves away. Instead, it shows up in small details scattered across the worker lifecycle, like a device in the wrong place, a phone number with no history behind it, or a document that seems a little off. Each of those details is easy to explain away on its own, and that's a big part of what makes fraud so hard to catch.

On their own, those details are signals. They don't prove anything, but they give you a reason to look a little closer. When a few show up together, they start to give you more clarity on what you're really dealing with. The pressure to spot them is only growing. Gartner predicts that by 2028, 1 in 4 candidate profiles worldwide will be fake.

Yardstik and Persona see thousands of these risk signals every day. We pulled together 37 of them, based on what we see ourselves and what we hear from the teams we work with. They span the full worker lifecycle, from the first application to the day-to-day work.

What are fraud signals

You'll hear these called fraud signals or risk signals. Whatever you call them, they're signs that something might be off. We lean toward risk signals, because that's what they do: they raise the potential risk level without proving anything on their own.

That's what separates a signal from the fraud itself. Synthetic identities and account takeover are fraud. Signals are the smaller details that point to potential fraud, and not all of them carry the same weight.

Every workforce reads these differently

How much a signal matters depends on what's around it and on how your people work. Take VPNs as an example. Using one can raise the likelihood that something is off since fraudsters use them to hide their location, but plenty of people use a VPN for perfectly good reasons, like privacy or a company policy. On its own, VPN use doesn't say much. Paired with an application from another country and an SSN already tied to someone else's profile, it says a lot more.

That's why we haven't ranked or scored anything on this list. The same signal can mean almost nothing in one situation and a lot in another. It's all about context.

The kind of workforce you have shapes that context, too. On gig and delivery platforms, people apply and work from their phones, so switching devices is more normal, and payout accounts and location data tend to say more. For in-person hourly roles, location carries more weight from the start. For remote teams, consistency is a big one: the same device, network, and person from the application through verification.

These are examples, not rules. The state on an ID can still raise the risk level for a remote role, and a device switch can still matter on a gig platform. Nobody knows what normal looks like in your process better than you do, so read this list with your own workforce in mind.

The complete list of risk signals

The 37 signals below follow the path a worker takes through your process: applying, verifying, onboarding, and working. What you can see about someone changes at each stage, so each stage has its own set of signals to watch for. That said, fraud is messy, and plenty of these signals can show up at more than one point in the process.

No list of risk signals is ever truly finished. New ones show up as fraud tactics change, some only exist inside a particular business, and many of the most telling signals aren't single details at all but combinations that add up. Think of these 37 as the foundation, the kinds of things a strong fraud program should be able to see, even though few companies have visibility into most of them today.

Applying

Most of these show up before anyone has been verified, in data you're probably already collecting: the device, the connection, and whatever the applicant types in. Catching them here is cheaper than catching them anywhere else.

1. A device outside your hiring footprint

The job is in Columbus and the device applying for it is in another country. If the role means showing up in person, that's one of the clearest early signals you'll get. Keep an eye out for the bigger version too, when a wave of applicants suddenly arrives from somewhere you've never hired.

2. Shared details across profiles

The same phone number, email, or address on profiles that otherwise have nothing to do with each other, or the same person coming back under a new email. One overlap could be a household or a typo. A handful can mean one person, or one group, is behind a lot of applications.

3. A phone number that doesn't hold up

VoIP and burner numbers, numbers that just moved to a new SIM, or numbers that don't connect back to the applicant at all. They're cheap to get and easy to throw away, which is exactly why people committing fraud like them.

4. A brand-new or disposable email

An address created the same day as the application, or one from a throwaway email service. Plenty of people set up a fresh email for a job search, so this one depends heavily on what else you're seeing.

5. An address that isn't a home

A PO box, a business address, or an address that can't receive mail. People have good reasons for PO boxes. But if the address doesn't point anywhere a person could actually live, they may be trying to hide where they really are.

6. One device, many applicants

A single device submitting applications for several different people. Someone is holding that device, and it's probably not all of them. Shared devices are also one of the most common threads connecting identities in organized fraud rings.

7. A device that isn't what it claims to be

Emulators posing as phones, browsers pretending to be a different device, and rooted or jailbroken phones that let someone change what the device reports. Most applicants never touch any of this, so it stands out when someone does.

8. A masked connection

VPNs, proxies, Tor, private browsing, or a connection running through a hosting company instead of a home or mobile provider. A lot of people use VPNs for privacy, so by itself it barely registers. Next to a location mismatch or a shared device, it looks more like someone trying not to be found.

9. Behavior that looks automated

Forms that fill instantly, steps completed with identical timing, or the exact same path through your application across different applicants. The opposite can tell you something too. Someone who takes far longer than normal, or keeps leaving and coming back, may be looking up answers they'd know if the details were really theirs.

10. Pasting in personal details

People type their own name, birthday, and address from memory. When every one of those gets copied and pasted in, the applicant may be working from a list.

11. A burst of sign-ups

A pile of new profiles in a short window, often with details that look a lot alike. A popular job post can cause a spike too, but real applicants don't usually look this similar.

12. A match on your blocklist

If you keep a list of SSNs, emails, IPs, or devices tied to past fraud, a match is one of the strongest signals you'll get. People who get turned away tend to come back, sometimes with only a detail or two changed.

Verifying

This is where fraud works hardest to look legitimate. Stolen and synthetic identities are built to get past basic checks, so the signals here focus on the gap between information that's real and a person who actually matches it. It's a big part of why identity verification and screening work best together.

13. The same SSN on more than one profile

One SSN under different names or emails. A typo could explain one wrong digit. It doesn't explain three different names.

14. A name and SSN that don't match

The SSN is real but belongs to someone else, or it isn't a valid number at all. It's one of the most basic checks there is, and it still catches a lot.

15. An identity with almost no history

The name and SSN check out, but there's barely anything behind them: few past addresses and nothing older than a year or two. A thin history is a common sign of a potential synthetic identity, where real details get mixed with made-up ones.

16. The same face under different names

One face on IDs with different names, or the same identity details with different faces. It can also be a selfie you've already seen on another profile, or different selfies with the exact same background. This is one of the few signals that almost never has an innocent explanation.

17. A verified identity that doesn't match what gets screened

Verification confirms one person, and then the background check runs on a name or address that's slightly different. When the two happen in separate systems, that gap can go unnoticed.

18. A lot of tries to pass verification

Five or six attempts, with a different photo or angle each time. Bad lighting explains a retry or two. A long string of them looks more like someone testing what gets through.

19. An age that doesn't fit the photo

The birthday on the ID says one thing and the selfie says another. Nobody looks exactly their age, but a 70-year-old's ID with a 20-something's face is hard to miss.

20. An ID barcode that doesn't match the front

Most driver's licenses carry the same details twice, printed on the front and encoded in the barcode on the back. If they disagree, the ID has probably been edited.

21. A photo of a photo

An ID or selfie that's actually a printout held up to the camera, a screenshot, or a picture of another screen. Odd glare, visible edges, and strange colors are common giveaways.

22. An ID that looks edited or reused

Faking a document used to take real skill. Now it takes a few minutes with the right AI tool. Look for the same image, template, or background behind different names, or colors and fonts that don't match a real ID.

23. A selfie or video that doesn't hold up

A selfie that doesn't quite match the ID, or video coming from a virtual camera instead of a real one. It happens in interviews too. In a Gartner survey of 3,000 job candidates, 6% admitted to interview fraud, either posing as someone else or having someone pose as them.

24. A location that doesn't match the ID

They say they live in Minneapolis, but their ID and their connection both say Florida. People move all the time, so on its own it may not mean much. Next to other signals, it gets harder to explain.

25. Activity at odd hours

Someone finishes identity verification at 3 a.m. in the time zone they say they live in. Night owls exist, but sometimes the timing makes a lot more sense for a different part of the world.

Onboarding

Once someone is through screening, it's easy to relax. But onboarding is when payment details, new devices, and documents all show up at once, which makes it a good time to notice something that doesn't add up.

26. A card issued far from the job

A new driver in Houston adds a payment card issued overseas. There can be a simple reason, but it's worth checking against device and location data. It's also easy to miss, because it lives in a payments system, not a hiring one.

27. One card, many people

The same payment card used across several workers. That often means one person is managing all of those accounts.

28. One person, many cards

A new hire tries card after card until one works. Mistyping a number happens. Cycling through five different cards is something else.

29. A payout account in someone else's name

The bank account set up for pay belongs to someone other than the worker. Sometimes it's a spouse. Sometimes the person doing the work isn't the one getting paid, or one person is collecting pay for several accounts.

30. An operating system switch mid-process

Someone applies on an iPhone and finishes onboarding on Android. If your workforce lives on their phones, people switch all the time and it may mean nothing. If onboarding is supposed to happen at a desk, a switch partway through can mean someone else picked it up.

31. Changes between steps

The device, network, or location shifts sharply from one step to the next. Someone applies from one city and verifies an hour later from another city hundreds of miles away, which isn't a trip anyone could make that fast.

32. Altered documents

Worker documents, registrations, insurance cards. Edited documents tend to show up at onboarding because that's when you ask for them.

Working

A background check tells you who someone was on the day you ran it. The signals here are about noticing when the person doing the work may not be the person you hired.

33. A login from an unfamiliar device or location

A worker who always logs in from the same phone in the same city suddenly shows up on a new device somewhere else. It could be a new phone. It could also be someone else in the account.

34. A re-verification that doesn't match

When you ask a worker to verify again, the face doesn't match the one from onboarding. It's about as direct a sign as you'll get that someone else is doing the work.

35. Work patterns that suddenly change

A daytime driver who starts working only overnight, in a different part of town, all at once. Schedules change for plenty of reasons, but a sudden shift can also mean a different person is using the account.

36. Sudden changes to account details

A new phone number, a new email, and a new payout account within a few days, or right before a big payout. People update their info all the time. A burst of changes to exactly the details that control the account deserves attention.

37. Location data that doesn't add up

A worker's location jumps faster than anyone could travel, or shows them somewhere their device can't be. That usually points to GPS spoofing, which matters most on gig platforms, where location drives dispatch and pay.

Seeing the whole picture

The signals are usually there. The ACFE's 2026 Report to the Nations found that 84% of fraudsters showed at least one warning sign before they were caught, but the typical scheme still ran for a year before anyone noticed.

Part of the problem is that signals are scattered. The device data lives in one system, the SSN in another, the payment card in a third, and it's rare for anyone to look at them side by side. Across what Yardstik and Persona see, fraud almost never comes down to one dramatic red flag. It's usually three or four quieter ones, spread out across the process.

Getting better at this starts with knowing what normal looks like for your own workforce, so the odd things stand out. It helps to pull together information that usually lives in different places, and to decide ahead of time what you'll do when signals start stacking up, whether that's another verification step, a manual review, or pausing the process. How much risk you're willing to take on is your call. The goal is to make it with the whole picture in front of you.

Knowing the signals is the first step. What to do once they start adding up is a harder question, and it's what we'll get into in How to Turn Fraud Signals Into Action, the live Fraudtober webinar at the end of the month.